News is coming in from the WordPress community that hackers have abused an old WordPress plugin, a legitimate one, to secretly compromise websites. The finding was revealed by Sucuri in a report published last week.
The plugin in question is Eval PHP, released by a developer called flashpixx. It lets users insert PHP code into WordPress pages and posts, which is then executed every time the posts are opened in a web browser.
Although Eval PHP has not received a single update in 11 years, statistics collected by WordPress show that it is installed on more than 8,000 websites. Its number of downloads also shot up from an average of one or two since September 2022 to 6,988 on 30 March 2023.
Comment by Olet
From the sudden jump in downloads we can easily and safely conclude that they were not made by the website administrators. The hackers already had access to thousands of websites. They also knew the weaknesses and capabilities of the plugin. Hiding behind this legitimate plugin, they installed it on the hacked websites and then ran the malicious code to harm those sites' visitors.
On 23 April 2023 alone, it was downloaded 2,140 times. The plugin had collected 23,110 downloads between 17 and 24 April. In total, the plugin was downloaded 120,573 times!
Comment by Olet
Think how many websites the hackers had already compromised! The vast majority of these downloads were made to serve the hackers. No sensible administrator would download an old, unmaintained, insecure plugin to their website. The next question is: Where were these thousands of hacked websites hosted, and what protection did their hosting providers have in place? It is worth answering, not to blame hosting providers, but to see which security systems do their job and which do not.
Fortunately, WordPress.org acted fairly quickly and closed the plugin on 26 April, as we can see on the Eval PHP page.
Sucuri, which is owned by GoDaddy, said it found malicious code on infected websites in the “wp_posts” table, which stores information about posts, pages and the navigation menu. The access requests came from three different IP addresses based in Russia.
“This code is quite simple: It uses the file_put_contents function to create a PHP script in the docroot of the website with the specified remote code execution backdoor”, said security researcher Ben Martin.
“Although the injection in question drops a conventional backdoor into the file structure, the combination of a legitimate plugin and a backdoor dropper in a WordPress website lets them reinfect the website and stay hidden. All the attacker needs to do is visit one of the infected posts or pages and the backdoor will be injected into the file structure.”
Sucuri said it has detected more than 6,000 instances of this backdoor on compromised websites in the last 6 months, describing the pattern of inserting the malware directly into the database as a “new and interesting development”.
This incident shows once again how threat actors experiment with different methods to keep their access to compromised environments and to evade server-side scans and file integrity monitoring.
Website owners are advised to secure the WP Admin Dashboard with strong passwords, check for any suspicious changes on their website and keep only up-to-date, modern plugins and themes.
Comment by Olet
There are some basic principles that every website administrator must follow to have a reliably high level of security. Follow these principles – practices to the letter, which Konet has often shared with its customers, to keep your website secure.
Source: https://thehackernews.com/2023/04/hackers-exploit-outdated-wordpress.html
This article is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You may republish it, provided you credit Konet as the source with a link to this article.
